CVE-2026-56391 GNU CVE debrief

Who should care

Users of GNU coreutils, particularly those who process untrusted input with the uniq utility, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system logs for unusual activity, restricting use of the -w (--check-chars) option with untrusted input, and updating GNU coreutils to a version including the fix. Security teams should prioritize patch deployment and monitor for potential adjacent heap memory exposure in affected systems.

Technical summary

The find_field() function in GNU coreutils uniq miscalculates the byte length of characters when processing multibyte input with the -w (--check-chars) option. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. This behavior leads to a crash and potential adjacent heap memory exposure. The issue has been fixed in commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

Defensive priority

Medium-priority defensive actions are required to address this vulnerability.

Recommended defensive actions

• Apply the patch from commit d64e35a8a4c0e4608321433e0d84d917e4e36371
• Restrict use of the -w (--check-chars) option with untrusted input
• Monitor for and update GNU coreutils to a version including the fix
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The find_field() function in GNU coreutils uniq miscalculates the byte length of characters when processing multibyte input with the -w (--check-chars) option, leading to out-of-bounds reads. This issue has been fixed in commit d64e35a8a4c0e4608321433e0d84d917e4e36371. Evidence is limited to public CVE details and vendor advisories. Defenders should verify patch deployment, review system logs for unusual activity, and monitor for potential adjacent heap memory exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.